Re: A "newbies" thoughts on cgi.pm... - A cautionary tale

A long time ago, before Windows NT 4.0 I was given a Windows NT 3.51 box to use, on which I installed the "EMWAC HTTPs" web server. Having worked only on remote *nix box previously without access to the CGI-BIN, this was a new experience.

I quickly learnt CGI, but found that Pascal/Delphi was more effort than it was worth to use with CGI, so I went off and got a Perl book and learnt that instead. Perl seemed popular, and there were plenty of scripts lying about free to use.

Though I had done programming before Perl was very new to me, and it took a while to find the correct resources. I found an old Perl4 CGI library "cgi-lib" and played with that. Back then CGI.pm wasn't distributed with copy of Perl I had, Matt Write didn't use it and anyway I didn't understand it.

I wrote some scripts based upon a customised version of cgi-lib and all was well. I was happy and it did "exactly what i want".

I quickly found that it was not ideal:

• If you distribute your scripts then you have to distribute your library
• It didn't do everything, so you have to for ever expand it
• It wasn't documented, so other people couldn't use it
• It was very unsafe

I had a problem, several script based on old and obsolte code, that was getting messy, difficult to distribute, and had no future.

In steps CGI.pm. Even in the days before ActiveState's PPM, I was able to install it from CPAN on a NT3.51 box. I believe it's shipped as standard with all versions of Perl now. Okay I now had to change my scripts, but I got the following:

• Properly tested code, Perl is easy, CGI is easy, but getting Perl/CGI right is hard. I'm not an expert in CGI, Perl or security, so I use code that's better than mine, and it'll be as good as possible.
• You can buy a book for this module (ISBN 0471247448), and the built-in POD is excellent. It's very well documnted, you don't have to read the source to figure out what it's doing...
• You don't have to use all of it, it goes out of it's way to load only the bits you want. Don't like it's HTML generation methods, don't use them.
• Comes in traditional and OO modes, pick the one you like best.
• If you read the docs you will find it's very flexible, and very easy to get it to do most of the things you may want it to do.
• Most modern scripts and good books will assume it's thre and use it. It is not perfect, but it'e very good, and very available.

Since switching to CGI.pm, my ego may have been deflated, but my code is simpler, more secure, and easy to distribute now.

My humble 2p